Sending a file shouldn't mean handing it to a company first. Here's what actually happens when you use Iriszip.
Your file is encrypted inside your browser before it ever leaves your device, using post-quantum key exchange alongside standard encryption — a hybrid designed to resist store-now-decrypt-later attacks by future quantum-capable adversaries. Only the device on the other end can unlock it. Nobody in between — not us, not your network — can read it.
Whenever possible, your file travels straight from your device to the other one, with nothing in the middle. When a direct path isn't possible, an encrypted relay passes the data along — still sealed, still unreadable to anyone but the two of you.
One honest note: when the connection is direct, your two devices talk to each other — so, as in every direct connection on the internet, the other person's device can see your network address. Our servers hold it in memory only while you are connected, to route the session and to stop flooding, and never log or keep it. A "relay only" option that hides it from the other side too is on the roadmap.
Your file is never written to disk. Even when a relay is used, the encrypted bytes pass through memory only and nothing is logged — no copies, no contents, no record of who sent what to whom. When the transfer is done, it's gone from our side because it was never kept in the first place.
You don't have to take our word for any of this. The encryption behind Iriszip was reviewed independently by the Scientific Cyber Security Association, who published their findings in a certificate of cryptographic security review.
The code this site serves is published at
github.com/iris-zip/iris.
You can check, at any moment, that the page in your browser is exactly
that code: open this site's source, find the
integrity="sha384-…" value next to
app.js, and compare it with the same hash published in the
repository's
HASHES.md.
If they match, the code running here is byte-for-byte the code anyone
can read. The encryption module checks its own hashes the same way
every time the page loads.
Email [email protected] with what you found and how to reproduce it. Please do not post it publicly or open a public issue first: the report stays confidential until we agree together that it is fixed. A person replies within three days, tells you within fourteen whether we can reproduce it, and a fix ships within ninety or we explain in writing why not. We ask for ninety days before you publish, and we will never threaten or pursue anyone who reports in good faith. There is no bug bounty; credit is yours by whatever name you choose, or none. Machine-readable version: security.txt.
© 2026 Iriszip Open Source